feat(CUST-WP-0021): multi-host repo path hardening — all 5 tasks complete

- T01 (done prior): registered host_paths for bnt-lap001 (14 repos) and
  COULOMBCORE (6 repos) via POST /repos/{slug}/paths/
- T02: validate_repo_adr now accepts repo_slug (not raw path); resolves
  local path via host_paths[hostname] → local_path; clear error for
  unregistered/missing paths
- T03: ingest_sbom_tool lockfile_path is now optional and relative to
  resolved repo root; absolute paths accepted with deprecation warning
- T04: check_repo_consistency pre-flight guard — fetches repo, resolves
  path, returns clear error before spawning subprocess if path missing
- T05: TOOLS.md — updated validate_repo_adr row (slug not path);
  added Multi-Host & Remote Agent Usage section documenting design
  boundary, remote agent workflow, and update_repo_path usage

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/CUST-WP-0021-multi-host-repo-paths.md

@@ -3,11 +3,12 @@ id: CUST-WP-0021
 type: workplan
 title: "State Hub — Multi-Host Repo Path Hardening"
 domain: custodian
-status: active
+status: done
 owner: custodian
 topic_slug: custodian
 created: "2026-03-18"
 updated: "2026-03-18"
+state_hub_workstream_id: "516ca332-5eac-4d6e-8bf9-b2694ed34276"
 ---
 
 # State Hub — Multi-Host Repo Path Hardening
@@ -50,8 +51,9 @@ This rule is documented in TOOLS.md.
 
 ```task
 id: CUST-WP-0021-T01
-status: todo
+status: done
 priority: high
+state_hub_task_id: "cf2c0449-9250-4425-925b-302482d75a11"
 ```
 
 COULOMBCORE hostname: `254.130.205.92.host.secureserver.net`
@@ -94,8 +96,9 @@ Use `POST /repos/{slug}/paths/` with `{"host": "<hostname>", "path": "<path>"}`.
 
 ```task
 id: CUST-WP-0021-T02
-status: todo
+status: done
 priority: high
+state_hub_task_id: "52ed094a-4216-4cd1-a634-a29b82f26ec5"
 ```
 
 Change `validate_repo_adr(repo_path: str, ...)` to
@@ -118,8 +121,9 @@ boundary (tool always runs against the server's copy).
 
 ```task
 id: CUST-WP-0021-T03
-status: todo
+status: done
 priority: medium
+state_hub_task_id: "2a67d5e2-f581-490c-b42e-0f7d37979c0a"
 ```
 
 Change `ingest_sbom_tool(repo_slug, lockfile_path: str)` so `lockfile_path`
@@ -141,8 +145,9 @@ Resolution logic:
 
 ```task
 id: CUST-WP-0021-T04
-status: todo
+status: done
 priority: medium
+state_hub_task_id: "3885497e-c491-4ddf-811f-0f0d19a0fc42"
 ```
 
 `check_repo_consistency` already resolves paths correctly via the script.
@@ -165,8 +170,9 @@ skips file checks. Add a pre-flight guard in the MCP tool:
 
 ```task
 id: CUST-WP-0021-T05
-status: todo
+status: done
 priority: low
+state_hub_task_id: "b4ba8cd0-1093-43ce-8a5d-03529e3c0588"
 ```
 
 Add a section to `state-hub/mcp_server/TOOLS.md` under a new heading